Their Exploitability Index numbers for these vulnerabilities re-emphasize that point of view. All three vulnerabilities are rated "3 - Functioning exploit code unlikely" on all platforms. Not just on Vista and Server 2008 where the vulnerabilities are less serious anyway, but even on XP, 2000 and Server 2003 where two of them could result in genuine remote code execution if successfully exploited.

For more detail on the Exploitability Index and what the ratings mean, see this explanation.

The vulnerabilities cause a fixed value (zero) to be written to kernel memorynot data that the attacker controls.

Controlling what data is overwritten is difficult. To exploit this type of kernel buffer overrun, an attacker typically needs to be able to predict the layout and contents of memory. The memory layout of the targeted machine will depend on various factors such as the physical characteristics (RAM, CPUs) of the system, system load, other SMB requests it is processing, etc.

Given these constraints you can argue that it's an overreaction even to call these critical vulnerabilities. We'll see over time if someone comes up with a reliable exploit for them.